Doxware - A Devilish Improvement to Ransomware

What is Doxware?

Some security experts call this form of cyber-extortion “doxware,” a combination of “ransomware” and “doxxing.” Doxxing is the nasty practice of publishing a victim’s home address, personal phone number, Social Security Number, compromising photos intended only for significant others, emails exchanged with your lawyer or tax accountant, sensitive documents, and other data that nobody wants to share with the whole world.

One doxware variant simply tacks on a doxxing component to an existing ransomware program. It works like this:

A victim acquires a doxware infection in one of the usual ways. Silently, the malware encrypts data, like any ransomware. But before encrypting, it scans for key phrases in documents and filnenames that indicate something of a sensitive nature, i. e., “nude,” “password,” “confidential,” etc. It copies such juicy-looking files to a server in the cloud, along with contact lists it finds. Then it displays a screen like the one below, telling the victim what to pay, how to pay it, and why he had better pay it by the specified deadline.

If the ransom is not paid in time, the stolen data will be published on a public server and its location will be emailed to all of the victim’s contacts. The victim won’t get the key that unlocks his encrypted hard drive, either.

Doxware adds the potential of public shaming to the private pain of lost data, increasing the likelihood that the victim will pay up. After all, you don’t have to decrypt your hard drive if you have a good backup copy of everything, or if there’s nothing irreplaceable and mission-critical on it. You can simply reformat the drive and start all over again. Also, several anti-ransomware programs that may be able to decrypt a drive have appeared since one gang of crooks published a rival gang’s list of encryption keys. (The latter may well have come up with doxware in response to this weakening of their scheme.)

The Fear Factor

But even if you circumvent the encryption, the sensitive data remains beyond your reach, a perpetual threat that you cannot eliminate. That is, provided the crook scooped up the right data; maybe you don’t care if everyone knows what he stole. But you don’t know what he scooped up, and fear of the unknown is the most powerful fear. A lot of people will drive themselves nuts scrutinizing all the files on their hard drive (after decrypting it) and wondering what might be damaging if it became known to their contacts.

Doxware is still rare compared to non-ubiquitous ransomware, but that won’t last for long if the doxware technique proves profitable. Keep your guard up, your anti-malware software up to date, and your sensitive data someplace other than your hard drive. If you must keep senstive material on your hard drive, use encryption to safeguard those files.

Your thoughts on this topic are welcome. Post your comment or question below...